The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes the claude CLI and python3 to perform reviews and parse results. It mitigates command injection risks by validating user-supplied inputs (model aliases and effort levels) against a strict regex (^[A-Za-z0-9._-]+$) and an enumeration of valid effort values. It also uses heredocs with random delimiters for prompt construction to ensure shell safety.
[PROMPT_INJECTION]: Robust guardrails are implemented to prevent instructions within input files from overriding agent behavior. The skill explicitly directs the model to treat all external content as data and includes a specific warning to disregard any directives like "ignore previous instructions" found in ingested files.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code and plans. It manages this surface area through:
Ingestion points: Reads project files, git diffs, and user-provided plan summaries (SKILL.md, references/plan-review.md).
Boundary markers: Utilizes explicit delimiters with unique random suffixes (e.g., <<<UNTRUSTED[suffix]) to wrap all external data.
Capability inventory: Limited to read-only CLI operations and local temporary file processing.
Sanitization: All dynamic shell arguments are validated before execution.
[PRIVILEGE_ESCALATION]: The skill requests scoped network access for the claude CLI to reach the Anthropic API and permission to maintain session state in the tool's standard configuration directory (~/.claude/). These requests are justified and limited to the tool's intended functionality.
[DATA_EXFILTRATION]: Data protection measures are in place to prevent accidental secret leakage. The agent is instructed to pass file paths to the CLI rather than inlining content, and the reviewer is prohibited from reproducing secrets in its final report.

claude-review